9.1
Critique
CVE-2026-18963 A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity…
Description
A flaw was found in the reset-credentials flow of the keycloak-services component, which is the core engine for identity and access management in Red Hat Build of Keycloak. The issue allows an unauthenticated attacker to force the password reset process for any user without needing to click the required email verification link. This can result in the attacker gaining full control over target user accounts by directly setting new credentials.
Produits et versions touchés
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Red Hat Build of Keycloak | Versions non publiées | |
| Red Hat JBoss Enterprise Application Platform Expansion Pack | Versions non publiées | |
| Red Hat Single Sign-On 7 | Versions non publiées | |
| Red Hat build of Keycloak 26.6.6 | Versions non publiées | |
| Red Hat build of Keycloak 26.4 26.4 | premières → < 26.4-23 | 26.4-23 |
| Red Hat build of Keycloak 26.6 26.6 | premières → < 26.6-12 | 26.6-12 |
| Red Hat build of Keycloak 26.4.15 | Versions non publiées | |
| Industrial Edge Management Cloud | Versions non publiées | |
| Industrial Edge Management Pro V1 1.14 | 1.14.9 → < 1.15.20 | 1.15.20 |
Afficher les 2 autres branches Masquer les 2 autres branches
| Produit | Versions touchées | Corrigé en |
|---|---|---|
| Industrial Edge Management Pro V2 2.2 | 2.2.0 → < 2.2.2 | 2.2.2 |
| Industrial Edge Management Virtual 2.6 | 2.6.0 → < 2.9.1 | 2.9.1 |
Références
- RHSA-2026:56519 access.redhat.com
- RHSA-2026:56520 access.redhat.com
- RHSA-2026:56523 access.redhat.com
- RHSA-2026:56524 access.redhat.com
- access.redhat.com access.redhat.com
- RHBZ#2511595 bugzilla.redhat.com
Chronologie
- Publiée
- Dernière modification
Autres CVE de Red Hat Build of Keycloak
Les 266 CVE de Red Hat Build of Keycloak →
CVE-2026-97847
Keycloak-services: keycloak-services: client manager can substitute sessionless token principal via hardcoded-claim mappers to obtain realm administrator authority
7.1
Élevée
CVE-2026-97175
Keycloak-services: keycloak-services: unverified idp email auto-linking enables account takeover
8.8
Élevée
CVE-2026-97174
Keycloak-services: keycloak-services: ciba sub parameter injection causes attacker authentication to issue victim tokens
6.8
Moyenne
CVE-2026-96453
Org.keycloak/keycloak-admin-cli: keycloak-admin-cli: kcadm custom truststore accepts arbitrary self-signed certificates
8.0
Élevée